2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A DevOps engineer is building a CI/CD pipeline that must encrypt artifacts before storing them in a Cloud Storage bucket. The pipeline runs on Cloud Build. The engineer wants to use a customer-managed key for encryption. What is the correct way to configure this?

   • ACreate a key ring and crypto key in Cloud KMS, grant the Cloud Build service account the Cloud KMS CryptoKey Encrypter/Decrypter role, and use the key in the build step to encrypt the artifact.
   • BUse the default encryption key provided by Cloud Storage, which is automatically used for all objects.
   • CStore the encryption key in Secret Manager and use it in the build step to encrypt the artifact.
   • DUse the Cloud KMS API directly from the build step without any IAM configuration.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A DevOps engineer needs to store a database password in Secret Manager and then access the latest version from a Cloud Function. What is the correct way to reference the secret in the Cloud Function code?

   • AUse the Secret Manager API to access the secret by name and version, e.g., projects/PROJECT_ID/secrets/MY_SECRET/versions/latest.
   • BUse the Cloud KMS API to decrypt the secret directly from the environment variable.
   • CReference the secret as a file path in the local filesystem, e.g., /secrets/MY_SECRET.
   • DUse the Cloud Storage bucket to read the secret from a file.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A DevOps engineer wants to inject a secret from Secret Manager into a Cloud Run service as an environment variable. What is the correct way to configure this?

   • AReference the secret in the Cloud Run service configuration using the 'secretKeyRef' field.
   • BMount the secret as a volume in the Cloud Run container.
   • CStore the secret in a Cloud Storage bucket and read it at startup.
   • DUse the Secret Manager API in the container's startup command to fetch the secret.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A DevOps engineer needs to inject a database password from Secret Manager into a running application on Compute Engine. What is a recommended way to do this?

   • AEmbed the password in the application's source code.
   • BUse the Secret Manager API at application startup to fetch the secret and set it as an environment variable.
   • CStore the password in a Cloud Storage bucket and download it at startup.
   • DUse the Cloud KMS API to decrypt the password at runtime.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses GitLab CI/CD to deploy to Google Cloud. They want to avoid storing a service account key in GitLab. What is the recommended way to authenticate?

   • AConfigure Workload Identity Federation with GitLab as the identity provider.
   • BUse a service account key stored in the GitLab CI/CD variables.
   • CCreate a service account key and store it in Secret Manager.
   • DUse the default service account of the GitLab runner if it runs on Google Cloud.
   Reveal Solution Discussion Select an answer first